code review 12745043: net/http: do not send malformed cookie domain attribute

net/http: do not send malformed cookie domain attribute

Malformed domain attributes are not sent in a Set-Cookie header.
Instead the domain attribute is dropped which turns the cookie
into a host-only cookie. This is much safer than dropping characters
from domain attribute.

Domain attributes with a leading dot '.' are still allowed, even
if discouraged by RFC 6265 section 4.1.1.


Fixes issue 6013

[volker.dobler, 2013-08-12 09:51:33]

Hello golang-dev@googlegroups.com (cc: bradfitz@golang.org,
golang-dev@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go/

[bradfitz, 2013-08-12 15:48:35]

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie.go
File src/pkg/net/http/cookie.go (right):

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie.go#...
src/pkg/net/http/cookie.go:295: var oldCookieValueSanitizer =
strings.NewReplacer("\n", " ", "\r", " ", ";", " ")
I believe these three lines can be deleted now.

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie_tes...
File src/pkg/net/http/cookie_test.go (right):

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie_tes...
src/pkg/net/http/cookie_test.go:40: &Cookie{Name: "cookie-6", Value: "six",
Domain: "bad-.abc"},
what about all that IP address business?

[volker.dobler, 2013-08-12 20:39:51]

PTAL

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie.go
File src/pkg/net/http/cookie.go (right):

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie.go#...
src/pkg/net/http/cookie.go:295: var oldCookieValueSanitizer =
strings.NewReplacer("\n", " ", "\r", " ", ";", " ")
On 2013/08/12 15:48:35, bradfitz wrote:
> I believe these three lines can be deleted now.

Done.

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie_tes...
File src/pkg/net/http/cookie_test.go (right):

https://codereview.appspot.com/12745043/diff/6001/src/pkg/net/http/cookie_tes...
src/pkg/net/http/cookie_test.go:40: &Cookie{Name: "cookie-6", Value: "six",
Domain: "bad-.abc"},
On 2013/08/12 15:48:35, bradfitz wrote:
> what about all that IP address business?

Done.

Added localhost as IPv4 and IPv6.

[bradfitz, 2013-08-12 22:00:06]

LGTM

[bradfitz, 2013-08-12 22:14:37]

*** Submitted as https://code.google.com/p/go/source/detail?r=1c523a432503 ***

net/http: do not send malformed cookie domain attribute

Malformed domain attributes are not sent in a Set-Cookie header.
Instead the domain attribute is dropped which turns the cookie
into a host-only cookie. This is much safer than dropping characters
from domain attribute.

Domain attributes with a leading dot '.' are still allowed, even
if discouraged by RFC 6265 section 4.1.1.


Fixes issue 6013

R=golang-dev, bradfitz
CC=golang-dev
https://codereview.appspot.com/12745043

Committer: Brad Fitzpatrick <bradfitz@golang.org>